I had a request from an internal IT business unit to create a monitor policy that would run in SMP7.0 that would alert a group if certain processes stopped functioning. At first it sounded easy, but then I re-read the email. Some of the processes needed to be monitored so that you could ensure 2 copies of them were running on the server. I first looked on here but didn't find much, other than a monitor in the SQL pack that monitored a process. This was my starting point and where I got the basics. This monitor evaluated if the instance of the exe being monitored was not equal to zero. I crossed my fingers that this wasn't a Boolean, as it turns out it doesn't. When I tested I just fired up a server, opened two command prompts to kick start the two cmd.exe processes.
Create a new agent based monitor policy
In the new Monitor policy in the Rule tab click the + button to add a new rule
Fill out a name and description (if you want) . I created a new category for windows processes
Under Actions change "Set severity to" warning
Click on the * under "Metrics"
Click the *new button and select "Windows Process"
Name the Metric, optionally add a description, I changed the polling interval to 30 seconds from 300 and type the exact name of the process and extension that you need to monitor. In this case we will monitor if a command prompt window is open. You can find the process name by looking at the server you want to monitor and looking at the task manager under processes. Hit OK
The new metric will be highlighted, click OK at the bottom
In this window I left the default "none" under statistics.
If evaluating only one instance keep condition set to "equal to". Since I am evaluating 2 instances of cmd.exe in this case, I set it to "Is less than". Keep value type to "constant". Because I want to have an alarm go off when less than two instances of cmd.exe are running, I have set value to 2. Hit OK when you are done
In this window could configure the rule to start a task back up, send out an alert email. I usually leave the alert email to come from the policy when the warning is tripped.
The new rule is already highlighted so click OK.
Apply the policy to a machine or a filter containing machines
Go into the Actions tab. This is where I traditionally send out alerts. Click the Warning tab. If you already have a warning alert click the + and add the warning alert. When done click save changes.
